Description

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T16:17:24.077Z",
  "pubdate": "2026-09-04T16:17:24.077Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.2 are susceptible to a critical Path Traversal vulnerability that facilitates arbitrary file or directory deletion.\nThe vulnerability originates from an improper limitation of pathnames to a restricted directory during file system operations.\nAn authenticated remote attacker can exploit this flaw to traverse outside of the intended application directory, gaining the ability to delete sensitive configuration files, system binaries, or application data.\nThis impact could result in a complete denial-of-service (DoS) for the Langflow application or potential system instability depending on the file permissions of the underlying host.\nExploitation requires the attacker to have an active authenticated session within the platform.\nGiven the ability to delete arbitrary files, the risk is severe, as it allows for the destruction of critical application components or malicious modification of the host environment.",
  "technicalDetails": "The vulnerability resides in the way IBM Langflow OSS processes user-supplied input intended for file system interactions. Specifically, the application fails to properly sanitize or validate file paths provided by authenticated users before passing them to internal file deletion functions.\nThe root cause is a lack of robust input validation or canonicalization, which allows for the inclusion of traversal sequences (e.g., '../') within the file path argument. When the application logic processes these sequences, it fails to enforce directory boundaries, permitting access to sensitive locations outside the intended working directory.\nAn attack flow typically begins with an authenticated user identifying an API endpoint or function within the Langflow interface that handles file management operations, such as deleting flows, components, or temporary project files.\nThe attacker intercepts the request—typically an HTTP request containing a path parameter—and injects path traversal sequences to point to a target file outside the application's root directory. Because the application logic does not properly resolve the path against a whitelist or restricted base directory, it executes the deletion operation on the attacker-supplied target path.\nIf the application process is running with elevated permissions, or if the target file has insecure permissions, the attacker can successfully remove arbitrary system files. The scope of the deletion is effectively limited only by the privileges assigned to the user account running the Langflow service.\nPost-exploitation impact is significant, as the attacker can delete configuration files essential for application startup, remove internal database files, or delete critical dependencies. This results in an immediate and persistent denial-of-service condition for the affected instance. If an attacker targets system-critical files, this could potentially escalate to broad system impact beyond the scope of the IBM Langflow application itself.\nThe vulnerability affects all versions of IBM Langflow OSS from 1.0.0 through 1.11.2. The lack of proper path validation is present across these versions, necessitating an upgrade or patch to sanitize all file-related inputs by implementing path normalization and checking against a predefined allowed directory path."
}